| ▲ | foobarian 3 hours ago |
| > internet-facing Plex servers This is terrifying. Who runs things like this open to the outside? |
|
| ▲ | wolrah an hour ago | parent | next [-] |
| > This is terrifying. Who runs things like this open to the outside? Probably the majority of people with a Plex Pass subscription and most Plex users in general. As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world. All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device. |
| |
| ▲ | falkensmaize an hour ago | parent | next [-] | | Plex in particular is notoriously insecure. It should never be accessible to the open internet unless via a vpn like WireGuard. Just playing with fire otherwise. | | |
| ▲ | eddythompson80 32 minutes ago | parent | next [-] | | Almost all selfhosted services are in that bucket now. Everything from Plex, Jellyfin, to nextcloud or gitea/forgejo. Few months ago I went through all my setup and moved everything to a vpn. The only service I kept public is a static directory served by nginx where I keep some html food recipes I shared with a friend before. It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream. | | | |
| ▲ | DaSHacka 39 minutes ago | parent | prev | next [-] | | That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance. Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do? I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com). Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs). Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon. FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request). | | |
| ▲ | yegle 37 minutes ago | parent [-] | | Tailscale is easy to explain. "Install this app on your Apple TV or Android TV, login with your Gmail, and let me know your email address." |
| |
| ▲ | izacus 44 minutes ago | parent | prev | next [-] | | Any citation for that or is that notoriety something that grew in your head? | |
| ▲ | wolrah 22 minutes ago | parent | prev [-] | | Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices. Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary. |
| |
| ▲ | walthamstow an hour ago | parent | prev [-] | | I don't think any more than 5% of Plex users are using it for legally-obtained content. |
|
|
| ▲ | dewey 3 hours ago | parent | prev | next [-] |
| Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them. |
|
| ▲ | doublepg23 an hour ago | parent | prev | next [-] |
| I'll fully admit I do. The point of Plex is sharing your library with less ... technical users. If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me. |
|
| ▲ | benoau 2 hours ago | parent | prev | next [-] |
| You largely have to for Plex themselves to middleman access to your media collection. |
|
| ▲ | blntechie 2 hours ago | parent | prev | next [-] |
| I do run it open to the outside through cloudflare tunnels. I don't want to connect my TVs to tailscale every time to play a movie. |
|
| ▲ | thejazzman an hour ago | parent | prev | next [-] |
| Feeling very validated that I went with Iroh @ https://pixelbrite.site |
| |
| ▲ | rumblefrog an hour ago | parent [-] | | This is my first time hearing about Pixel Brite, what's the history behind it? |
|
|
| ▲ | bigstrat2003 2 hours ago | parent | prev | next [-] |
| I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose). |
|
| ▲ | happytoexplain an hour ago | parent | prev | next [-] |
| Essentially every technical person I know. |
|
| ▲ | symlinkk 2 hours ago | parent | prev | next [-] |
| Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there. |
| |
| ▲ | Orygin an hour ago | parent | next [-] | | What get me the most, are the rabid Plex fanbois swearing that having jellyfin open on the internet is such a baaaad idea and you should spend ~50~ ~100~ 500 bucks for a sub to Plex which totally don't expose the same risk | | | |
| ▲ | iAMkenough 2 hours ago | parent | prev [-] | | If you’re exposing anything on Synology to the Internet, you’re already playing with fire. Their packages (like Container Manager) are usually very far behind on security patches. I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago. | | |
| ▲ | thenthenthen an hour ago | parent | next [-] | | Yeah, please avoid Synology, really. If you have it or need it DONT expose it to the internet. | |
| ▲ | chrisweekly 2 hours ago | parent | prev [-] | | Synology NAS - an ugly doorstop with data loss resulting from its half-baked post-purchase attempts to enforce hardware vendor lock-in. (Was working fine w/ a Western Digital drive, the next day, boom.) | | |
| ▲ | quietsegfault an hour ago | parent [-] | | I’ve had a synology NAS that’s been running for 8 years. No data loss. I use random drives I had laying around. It’s not the fastest or fanciest, but I never had any experience with lock in. It’s got a 3rd party 10g card, more memory … nothing locked in. |
|
|
|
|
| ▲ | TacticalCoder an hour ago | parent | prev [-] |
| > This is terrifying. Who runs things like this open to the outside? A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it). It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it. Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container. When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore. All that I care about are data: like family pictures and movies (and, say, other movies). My Jellyfin server is just a temporary "view" on my actual data. I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed. |